CVE-2026-18692
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
A vulnerability in MongoDB Server's timeseries bucket lifecycle handling allows an authenticated user with write privileges to trigger a use-after-free condition. Subsequent operations could result in a server crash or potentially execution of unintended code.
Risk Assessment
The risk includes denial of service and potential remote code execution, which could lead to full server compromise.
Recommendation
Update MongoDB Server immediately to a patched version and restrict write privileges.
Original NVD description (English source)
An issue in MongoDB Server's handling of timeseries bucket lifecycle could allow an authenticated user with write privileges to cause an internal reference to be used after the underlying memory has been freed. Subsequent operations could then result in a server crash or, potentially, execution of unintended code.